What should I ask for when verifying open source compliance of purchased commercial software?

Question

Our company was recently acquired, and I've been tasked to verify that our software is compliant with respect to open source licenses.

Specifically, I have been asked to obtain from software vendors that we purchased libraries from, a document that verifies the purchased software does not contain open source software (OSS) which, by being sold as closed-source, might violate its original license.

I am a software developer (not a lawyer), but am familiar with the various licenses that OSS can be distributed under. I am familiar with checking OSS licenses before bundling or embedding it with our own commercial software, however I've not previously been required to question vendors of commercially-licensed software.

Is there a particular document that I should be asking for? If so, what is the proper way to refer to it without having to explain the above? I am not looking for legal advice, but instead asking if there's a common name for this procedure (or if this is even commonly done at all).

Answer 1

The task of ensuring that your software is compliant with open source licenses is not unrealistic, nor is ensuring that your vendors also comply with appropriate open source licenses.

The first layer of defense would be a software composition analysis tool. There are several options - Black Duck, FOSSA, and WhiteSource are three examples of what is available. These tools will scan your dependencies and report on security (CVEs) and license concerns.

However, this doesn't fully solve the problem. Especially in the case where your vendors are providing closed-source libraries, you can't be sure what is included in them in all cases. This is where you would need to have robust vendor management processes. When choosing a vendor, you would need to somehow select one over another. Understanding how they manage they ensure compliance with open source licenses as well as manage their closed-source vendors would be entirely in scope for your vendor management process.

There's no standard document to ask for. However, performing vendor assessments and perhaps even auditing your suppliers to ensure that they are capable of meeting your needs is not out of the question. Depending on the vendor, they may undergo various third-party audits and assessments that may cover their vendor management processes and can produce reports for you.